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OIG Audit Report No. 12-12 



Executive Summary 



The National Archives and Records Administration's (NARA) Office of Inspector General 
(OIG) completed an audit of NARA' s parking program. During this audit, we assessed whether 
NARA's controls over parking were effective and in accordance with NARA policy. We found 
that NARA expended over $430,000 for an automated License Plate Recognition (LPR) system 
at All which is not fully functional. This condition was the result of inadequate planning, lack of 
appropriate oversight, and flawed contractual terms. Both the assignment of culpability and the 
opportunity to identify the cause of the failure were compromised as, per NARA's Lead Security 
Specialist, emails associated with the procurement action were inadvertently deleted. As a result, 
NARA is left with a failed parking control system, a lack of recourse to apply against the vendor, 
and the loss of taxpayer funds in an austere budget environment. 

NARA relies on Policy Directive 232, Parking at the National Archives at College Park 
(Archives II) (NARA 232), Security Post Orders (Post Orders), and a License Plate Recognition 
(LPR) system as the means to control parking at the National Archives Building in College Park, 
Maryland (All). Issued on April 26, 2006, NARA 232 provides procedures to control parking at 
AIL Post Orders provide general procedures for security officers to follow while posted at 
specified locations throughout All and its grounds. The LPR system was implemented to control 
access barriers to NARA's satellite parking lot (Pepco Lot) and validate parking authorization at 
all vehicle entrances at All to ensure employees and contractors park in their designated areas. 

Our review found three issues that prevented NARA's parking program from fully meeting 
NARA requirements and lessened the effectiveness of NARA's controls over the parking 
program. 

Although the delivery order for the LPR system, a key component in NARA's efforts to control 
parking at All, was signed in August of 2009, the operation of the system at the Adelphi Road 
main gate (Main Gate), the Metzerott Road loading dock gate (Loading Dock), and the Pepco 
Lot is not consistent. This is despite the fact that NARA has spent over $430,000 on this system. 

Additionally, NARA management failed to ensure that decisions regarding the LPR system were 
adequately documented. GAO's "Standards for Internal Control in the Government require all 
transactions and other significant events to be clearly documented and readily available for 
examination. Despite this requirement, a lack of sufficient documentation hindered our ability to 
identify and review decisions Security Management Division (BX) and Facilities and Property 
Management Division (BF) personnel made related to the LPR system. 

Lastly, BX personnel made the decision not to update NARA's policies and procedures used to 
control parking at All to reference use of the LPR system until the system had been accepted. 
As of the end of fieldwork the LPR system had not been accepted, thus NARA's parking policies 
and procedures are not current and do not reflect the actual practices of NARA personnel. The 
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fact that these policies and procedures were not current was due in large part to the setbacks 
experienced with the LPR system. 

This report contains four recommendations to strengthen the effectiveness of NARA's controls 
over the parking program. 
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Background 



The National Archives at College Park (All) has three separate vehicle entrances; the Pepco Lot, 
the Main Gate, and the Loading Dock. Security Management Division (BX) personnel stated 
that the proximity of the Main Gate and the Loading Dock to the perimeter of All would always 
necessitate human intervention in the form of security officers posted at these locations. 
However, in an effort to reduce costs, a radio-frequency identification (RFID) system was 
installed at the Pepco Lot to replace the security officer at this location. This RFID system used 
vehicle hangtags (parking permits) to automatically control the gates at the Pepco Lot allowing 
access to authorized vehicles. Although NARA employees are directed to park at the Main Gate 
and contractors are directed to park at the Pepco Lot, NARA distributed parking permits to all 
NARA employees and contractors. NARA relied on these parking permits to control parking at 
AIL 

In August of 2008 the RFID system experienced a failure. When BX personnel contacted the 
RFID system vendor to request repairs, they were informed the system was no longer supported 
or maintained by the vendor. Shortly thereafter Facilities and Property Management Division 
(BF) personnel, with input from BX, decided to research options to replace the existing RFID 
system. 

The agreed upon replacement was the LPR system that would both read license plates at all of 
All's entrances and control access to the Pepco Lot. NARA personnel stated they did not choose 
to install another RFID system because they wanted to avoid issues associated with RFID 
systems as well as distributing and maintaining parking permits. The LPR system was acquired 
as a delivery order on a NARA Indefinite Delivery Indefinite Quantity (IDIQ) Contract with 
Heery International, Incorporated (Heery) for construction management and design build 
services. This delivery order was signed on August 31, 2009 for a cost of $460,528. 



Figure 1: Timeline of NARA's Implementation of the LPR System 




After the LPR system was installed, NARA officially ceased distribution of parking permits. 
NARA also issued an internal NARA Notice stating its intention to collect all parking permits 
previously issued to employees and contractors near the end of the project. However, because 
the LPR system is not functioning properly and therefore has not been accepted by NARA, no 
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notice has been issued instructing NARA employees and contractors to turn in their parking 
permits. Consequently, in order to control parking NARA is relying on an LPR system that is 
not fully functional and parking permits that are no longer officially distributed. 

In an OIG management letter dated April 13, 2005, the Inspector General stated that information 
technology (IT) investments can have a dramatic impact on an organization's performance. 
Well-managed IT investments, carefully selected and focused on meeting mission needs, can 
propel an organization forward, dramatically improving performance while reducing costs. 
Likewise, poor investments - those that are inadequately justified or whose costs, risks, and 
benefits are poorly managed - can hinder and even restrict an organization's performance. 
Unfortunately, the implementation of the LPR system demonstrates that after almost seven years 
NARA has yet to fully grasp the importance of properly managing its IT investments to ensure 
they are functionally completed on time and on budget. 
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Objectives, Scope, Methodology 



The overall objective of this audit was to determine whether NARA's new parking system, as 
well as NARA's parking program as a whole, met the needs of NARA requirements. The 
objective also included a determination as to whether the controls over the parking system and 
the overall parking program were effective. Our review placed particular emphasis on NARA's 
new parking system, the LPR system. 

In order to accomplish our objectives we performed the following: 

> interviewed key NARA personnel from Information Services and Business Support 
Services; 

> requested and reviewed documents in place used to control parking or establish 
requirements over parking at National Archives at College Park (All) including all 
policies, directives, or similar documents; 

> compared the implementation of the parking program to NARA policy; 

> reviewed the applicable laws and regulations related to parking at All as well as the 
contract and delivery order for the LPR system and all subsequent modifications; and 

> reviewed 36 CFR Appendix A to Part 1234 - Minimum Security Standards for Level III 
Federal Facilities to ensure NARA met these standards. 

Our audit work was performed at Archives II in College Park, Maryland. The audit took place 
between December 201 1 and March 2012. We conducted this audit in accordance with generally 
accepted government auditing standards. Those standards require that we plan and perform the 
audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence obtained provides a 
reasonable basis for our findings and conclusions based on our audit objectives. 
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Audit Results 



1. The License Plate Recognition (LPR) system is not fully 
operational. 

As of the end of fieldwork for this audit, over two years after the initial estimated completion 
date, the LPR system was not fully operational. The LPR system was in place and functioning 
inconsistently at All's three entrances, the Main Gate, the Loading Dock, and the Pepco Lot. 
Numerous issues, described in more detail below, prevented NARA from depending on the LPR 
system to control parking. Therefore, NARA had yet to accept the LPR system and the parking 
program at All was relying on a system that was not fully operational. 

LPR System Issues 

The LPR system has encountered, and continues to encounter, obstacles that have prevented the 
system from operating consistently at AIL After the delivery order was signed in August of 
2009 the LPR system was scheduled to be fully operational by the end of that year. The first 
progress meeting for the LPR system was held between NARA and the contractor on April 21, 
2010. This meeting represented the first of many interactions between NARA and Heery where 
issues delaying the full operation of the LPR system were identified and discussed. 

NARA experienced issues with the LPR system's inability to operate consistently and accurately 
throughout May and June of 2010 which caused "a high level of frustration and confusion with 
employees." This led Security Management Division (BX) personnel to state that "the LPR 
system is a hit or miss to pick up and record a tag number. However, in the event it has recorded 
tags, it is not displaying it for our guards at the display panels." In an effort to remedy the 
problems the LPR system was experiencing, NARA issued two modifications to the original 
delivery order in August of 2010. These modifications focused primarily on revamping ground 
loops, repairing bollards, and relocating a message board. The modifications added over 
$36,000 to the original delivery order bringing the total cost of the LPR system to approximately 
$500,000. However, the LPR system was still not fully functional after the completion of these 
modifications, leading NARA to send Heery a letter (a CURE Notice) informing them the 
contract would be terminated in thirty days unless changes were made to the system in 
November of 2010 (See Appendix D). 

NARA's CURE Notice stated that the LPR system's software could not identify a variety of 
license plates. In the CURE Notice NARA requested a 100% reading rate for all variety of 
license plates at the Pepco Lot. NARA requested the 100% reading rate at the Pepco Lot 
because this lot was planned to be 100% automatically controlled by the LPR system, thus 
NARA could not afford anything other than a 100% reading rate. NARA felt a CURE Notice 
needed to be sent after a year of "software changes, failed readings, system malfunctions and 
inconveniences" experienced by "NARA staff, researchers, visitors, contractors and volunteers." 
Additionally, NARA believed that 15 months was enough time to complete a project that 

Page 8 

National Archives and Records Administration 



OIG Audit Report No. 12-12 



"should have been accomplished in no more than four months." General Counsel (NGC) 
personnel stated during an interview that no NGC requirement was in place to review this CURE 
Notice for legal sufficiency, thus no review was performed. However, NGC personnel did state 
that it would seem to make sense to require NGC review of all CURE Notices for legal 
sufficiency before distribution. CURE Notices are an initial step in terminating a contract, an 
action which often has legal consequences. As such, NGC should become a part of the process 
at the earliest stage to utilize their expertise. A review of CURE Notices for legal sufficiency 
would allow NARA to ensure the effectiveness of the document, enhance the prospect of vendor 
compliance with NARA requirements, and could help support NARA's basis for legal recourse if 
the defects are not cured. 

Heery responded to NARA's CURE Notice on December 6, 2010 and agreed that installation 
and testing of the LPR system had taken longer than anyone on the project team envisioned or 
was happy with (See Appendix E). However, Heery also claimed several factors that accounted 
for the complications and delays. These factors included limited physical access to the system, a 
lack of remote access, required wiring changes after removal of the RFID system, failures of 
existing fiber optic cables, and improper installation of ground loops. Heery laid out a 
completion schedule with the goal of completing the project by December 17, 2010. 

After receiving Heery' s response to the CURE Notice Facilities and Property Management 
Division (BF) personnel stated that they "do not see any light at the end of the tunnel" for the 
project. This proved true because despite the goal of completing the project by December 17, 
2010, several issues, identified by NARA on January 13, 201 1, are still outstanding as of the end 
of fieldwork. Heery addressed these issues in a March 201 1 letter to NARA. The issues, 
followed by Heery' s responses, are as follows: 

> Gate Arm and Bollard Operation at the Pepco Lot 

• Heery stated that they were directed by NARA to perform additional work to 
modify the operation of the gates and bollards at the Pepco Lot. Heery stated that 
any additional work desired by NARA to address this issue must be at additional 
cost to the contract and authorized in advance by NARA. 

> Read Accuracy Percentage 

• Heery accurately noted that the scope of work developed by NARA, which served 
as the basis for Heery' s subcontractor's proposal to NARA, did not specify a 
required license plate read accuracy percentage. NARA confirmed this in a 
March 201 1 internal email. Heery stated that any additional work desired by 
NARA to address this issue must be at additional cost to the contract and 
authorized in advance by NARA. 

> Stacked Character Recognition 

• Heery noted that the introduction of the "War of 1812" Maryland license plates 
that represent the majority of the stacked characters encountered by the system 
began in June of 2010, well after the job was bid and awarded. Heery' s 
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subcontractor indicated any additional software costs required to address this 
issue will be an additional cost to the contract. 

Heery also stated in its March 201 1 letter that the project achieved substantial completion and 
complied with both the contract and the intent of NARA' s scope of work on December 9, 2010, 
when the system was placed into operation by NARA. 

Although Heery stated that the LPR system achieved substantial completion in December of 
2010, NARA has continued to experience problems with the system. In April of 201 1 BX 
personnel stated that the "system is critical to control our access at all entry points" but "is still 
out of service." Additionally in April of 201 1 error messages were encountered that locked up 
the LPR system and required the system to be restarted. These error messages continued 
throughout the remainder of 201 1, and still existed at the end of fieldwork. BX personnel stated 
in February of 2012 that these error messages continue to appear approximately once a week, 
requiring BX personnel to restart the system. In fact, BX personnel drafted procedures that hang 
next to the LPR system detailing the steps to re-start the LPR system in the event the error 
message appears. 

In July of 201 1, Heery' s subcontractor stated that they were working on a solution to the error 
message problem. Heery' s subcontractor also inquired about the possibility of remotely 
accessing the LPR system, reiterating an issue originally brought up in December of 2010. BX 
personnel stated that providing remote access to Heery' s subcontractors would enable the 
subcontractors to update the LPR system remotely potentially allowing the LPR system software 
the ability to read stacked letters and images in order to make the LPR system fully operational. 
However, after speaking with NARA personnel, it appears that the earliest remote access for 
Heery' s subcontractors would occur is middle to late May of 2012. 

NARA and Heery seemingly have come to a standstill on this project due to the issues identified 
above. This is illustrated in statements within a February 201 1 email sent by BF personnel, 
stating it "appears that they (Heery' s subcontractor) probably got paid up front and are unwilling 
to spend any more resources, since (Heery' s subcontractor) is losing money on this project." 
Furthermore, BF personnel stated, "I thought that we may see an end by 2010, later moved 
to spring 201 1, and now I do not have any comfortable feel for the successful completion of this 
project, unless Heery can take action to bring this to a conclusion." In order for NARA to rely 
on the LPR system as a control for parking at All the system needs to be fully operational at all 
three of All's entrances. For this to occur, NARA and Heery need to resolve these outstanding 
issues. If these issues cannot be rectified, then NARA needs to implement a new strategy to 
control parking at All that reduces its reliance the LPR system. 

No Controls Over the Pepco Lot 

It was noted at the end of fieldwork, each weekday from 5:30am through 10:00pm the gates at 
the Pepco Lot remained in the up and open position, allowing vehicles unfettered access. Thus, 
the Pepco Lot had no controls over parking. In fact, every weekday any person or persons could 
park at the Pepco Lot between 5:30am and 10:00pm without any type of screening. BX 
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personnel stated that controlling parking at All consists of creating a buffer zone of 100 feet 
around the perimeter of the building. Since the Pepco Lot is greater than 100 feet from the 
perimeter of the building, BX personnel did not have concerns with the lack of parking controls 
at the Pepco Lot. 

Because contractors are not authorized to park in the parking garage at the Main Gate, they are 
directed to park at the Pepco Lot. However, the lack of screening over parking at the Pepco Lot 
could allow individuals, who have no involvement with NARA as either visitors or researchers, 
to park at this lot as well. If the LPR system cannot be made operational at the Pepco Lot, then 
NARA needs to reexamine whether the controls over parking at the Pepco Lot are sufficient. 
Also, if BX personnel are not concerned with the lack of parking controls at the Pepco Lot, then 
they should ensure that projects such as the LPR system, which were implemented to control 
parking at the Pepco Lot, are analyzed and vetted thoroughly before being accepted. 

LPR System Not Properly Evaluated Before Implementation 

NARA has processes in place requiring the review of certain projects before acceptance and 
implementation. These processes include the Capital Planning and Investment Control (CPIC) 
process, Privacy Impact Assessments (PIA), and NGC review of new tasks added to a contract 
with a value more than $100,000. Our review of the LPR system found that two of these three 
processes did not occur, and the third only occurred after determined insistence from NGC 
personnel. BX personnel stated that putting projects through processes such as the CPIC process 
can end up "costing the government more money than not doing them." However, the CPIC 
process, as well as PIA's and NGC review serve to ensure projects address NARA's strategic 
needs and are properly reviewed before limited NARA resources are invested in them. 

The CPIC process was instituted by NARA to optimize the use of limited IT resources. 
Described in NARA 801, Capital Planning and Investment Control, this process employs the 
Clinger-Cohen Act designed to implement a process for maximizing value and addressing and 
managing the risks of IT acquisitions, such as the LPR system. The Clinger-Cohen Act defines 
IT as any equipment or interconnected system or subsystem or equipment that is used in the 
automatic acquisition, storage, manipulation, management, movement, control, display, 
switching, interchange, transmission, or reception of data or information. Because the LPR 
system clearly fits within the Act's definition of IT, the project should have been planned, 
reviewed, and approved in accordance with NARA 801 requirements. 

IT Policy and Planning Branch (ISP) personnel, tasked with oversight of the CPIC process, 
stated during an interview that the LPR system should have undergone the CPIC process. ISP 
personnel also stated that the program office is responsible for contacting ISP when new projects 
are initiated. The program office for the LPR system, BX, failed to notify ISP regarding the 
initiation of the LPR system. Had BX contacted ISP and ensured that the LPR system followed 
the CPIC process, it is possible that the difficulties the system experienced could have been 
mitigated. Indeed, ISP personnel, tasked with oversight of the CPIC process, stated that projects 
that do not go through the CPIC process can experience difficulties being put into operation, 
which is precisely what occurred to the LPR system. 
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NARA also mandates the completion of a PIA to determine the risks and effects of collecting, 
maintaining, and disseminating information in identifiable form in an electronic information 
system. Although a PIA was completed for the LPR system, it was not signed until November of 
201 1, over two years after NARA signed the delivery order for the LPR system. Also, based on 
emails reviewed during the audit, it appears that the PIA was completed mainly due to the 
insistence of NGC personnel, who first contacted BX personnel in July of 2010. 

A PIA was required for the LPR system because it collected information specific to individuals 
including name, license plate number, and NARA affiliation. An additional catalyst for the 
completion of a PIA was the misuse of personally identifiable info rmation (PII) within the LPR 
system by a contractor working on the system. On April 21,2011, 

the contractor overseeing the installation and performance of the LPR system, accessed the LPR 
system to obtain and use PII for personal reasons. This individual's access to All was terminated 
the following day by NARA. 

NGC generally reviews new tasks in order to determine that contracts drafted for these tasks, and 
their associated scope of work, are legally sufficient. As a part of our review we contacted NGC 
personnel who stated that the only way to confirm whether NGC reviewed the LPR system 
contract is if the contract file contains the approval sheet NGC signs when reviewing contracts. 
Our audit revealed no such document. In addition, BX personnel interviewed during our review 
did not have knowledge as to whether a legal review was performed. The fact that a legal review 
was not performed on the LPR system scope of work became an issue during installation of the 
LPR system as BX personnel stated that language left out of the LPR system scope of work 
related to the read rate accuracy of the LPR system led to too much interpretation. 

NARA issued Heery a CURE Notice on November 19, 2010 requesting a 100% reading rate for 
all variety of license plates. However, Heery accurately noted in its response to the CURE 
Notice that no required read rate for the LPR was included in the scope of work developed by 
NARA which served as the basis for Heery' s subcontractor's proposal to NARA. It is possible 
that if a legal review had been performed on the LPR contract and scope of work, this kind of 
absence of definite requirements would have been discovered and rectified. However, no 
evidence was identified that proved a review was performed and consequently key contract 
requirements, such as a read rate percentage were left vague or out of the scope of work. 

Loading Dock Option 

All has three vehicle entrances for parking: the Main Gate off Adelphi Road, the Pepco Lot, and 
the Loading Dock entrance off Metzerott Road. The purpose of the LPR system was to control 
parking at the Pepco Lot and validate parking at All's other entrances. BX had the LPR system 
installed at the Loading Dock even though this entrance to All already had procedures in place to 
control parking, resulting in a cost of approximately $100,000 to NARA. 

Heery' s August 20, 2009 proposal to NARA, which was ultimately accepted by NARA, was 
broken into two parts. The first part included installation of the LPR system at both the Main 

Page 12 

National Archives and Records Administration 



OIG Audit Report No. 12-12 



Gate and the Pepco Lot for a combined cost of approximately $360,000. The second part of the 
proposal consisted of installation of the LPR system at the Loading Dock for approximately 
$100,000. Thus, the total cost of installing the LPR system at all three of All's parking entrances 
was approximately $460,000. 

NARA personnel from BX stated the original RFID system was introduced at the Pepco Lot in 
2005 or 2006 to "save bucks" by relying on the RFID system to control parking at the lot thereby 
allowing NARA to eliminate the security officer who previously manned this post. The RFID 
system functioned only at the Pepco Lot entrance to AIL The LPR system, introduced to replace 
the RFID system, was installed at all three of All's parking entrances, including the Loading 
Dock. 

The Post Orders for the Loading Dock entrance state that it is manned by a security officer from 
5:30am until 6:00pm each weekday. The security officer posted at the Loading Dock is also 
instructed to physically touch, check and validate all non-NARA ID's prior to granting access. 
Parking is not allowed at the Loading Dock when it is not manned by a security officer unless the 
driver of the vehicle has been issued an overnight parking permit. Because of NARA' s standing 
procedures in place at the Loading Dock entrance, the decision to install the LPR system at this 
parking entrance seemed unnecessary due to the vigorous controls for parking already in place at 
this entrance. Furthermore, the parking lot at the Loading Dock only holds approximately 50 
spaces, and according to BX personnel would always require human intervention. 

BX personnel stated that the LPR system was installed at the Loading Dock because BX no 
longer wished to distribute or maintain parking permits. They also stated that the system would 
"back officers up" by allowing them to know in advance whether a vehicle was in the LPR 
system database, not in the database, or only allowed Pepco Lot access. However, NARA 
selected an option to a contract, costing approximately $100,000 that was unnecessary due to the 
existing procedures in place at the Loading Dock. In addition, BX was unable to produce 
documentation, other than responses to interview questions, showing who made the decision to 
install the LPR system at the Loading Dock, and why the decision was made. 

RFID Option 

A replacement RFID system was researched to replace the original RFID system used to control 
parking at the Pepco Lot that reached the end of its useful life in August of 2008. BX received a 
quote for $22,940, less than 5% of the cost of the LPR system selected to replace the original 
RFID system. Although BX had reasons not to implement a replacement RFID system, 
discussed below, a cost-benefit analysis should have been performed on this alternative. 

BX personnel stated many reasons why they preferred an LPR system to control access at the 
Pepco Lot as opposed to purchasing a replacement RFID system. For instance, BX personnel 
stated in an email "doing away with hangtag management was one of the primary goals. The 
hangtags are not that durable and an on-going expensive [sic] to re-purchase. It is labor intensive 
for the agency each time they need to be re-issued and would result in hundreds of hours of 
productive time lost for each tag holder to do an exchange. Performance was another issue. 

Page 13 

National Archives and Records Administration 



OIG Audit Report No. 12-12 



Issues with rain and other weather conditions, windshield tinting, visibility of the physical 
hanging tags, vehicle size and tag location and repeated antenna misalignment often prevented 
reliable reads by the system." Vulnerabilities with a replacement RFID system were also cited 
by BX personnel as to why an LPR system was preferred over an RFID system. These 
vulnerabilities included issues NARA supervisors faced when attempting to retrieve unreturned 
hangtags and security concerns related to lost or stolen hangtags. 

A replacement RFID system was researched and BX did receive a quote in May of 2008. The 
total cost of this system was $22,940, less than 5% of the cost of the LPR system. In the current 
"austere budget environment faced by all Federal agencies" as stated by Archivist Ferriero, it is 
essential to ensure that alternatives for projects are appropriately researched and analyzed. 

Figure 2: Comparison of Parking Control System Costs 
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Recommendations 



1. We recommend Business Support Services (B): 



a. Establish a deadline to have the LPR system operational and able to read license 
plates at an acceptable read accuracy percentage at All's three entrances before 
acceptance of the system by NARA. If the LPR system cannot be made operational 
and cannot read license plates at an acceptable read accuracy percentage at All's 
three entrances by this deadline then NARA needs to implement a new strategy to 
control parking at All that reduces its reliance on the LPR system. 

b. Re-examine the sufficiency of the parking controls in place at the Pepco Lot. 

c. Ensure compliance with NARA Directive 801, including ensuring that the options 
and alternatives for all new projects are properly analyzed and considered before any 
new projects are initiated. 
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d. For projects greater than $100,000 ensure the contract and associated scope of work is 
reviewed by General Counsel (NGC) before the project is initiated. 

2. We recommend the establishment of a NARA policy requiring General Counsel (NGC) 
review of CURE Notices before they are sent to contractors. 

Management Response 

Management concurred with the recommendations. 
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2. There is a lack of sufficient documentation for decisions 
regarding the LPR system. 

NARA management failed to ensure that decisions regarding the LPR system were adequately 
documented. The Government Accountability Office's (GAO) "Standards for Internal Control 
in the Government" require that all transactions and other significant events be clearly 
documented and readily available for examination. These standards further require that all 
documentation and records be properly managed and maintained. Despite this requirement, a 
lack of sufficient documentation regarding the LPR system hindered our ability to identify and 
review decisions BX and BF personnel made related to the LPR system. 

The need for a clear audit trail was especially important for this project because of the personnel 
changes that occurred during the selection and implementation of the LPR system. The LPR 
system was first considered by BX in August of 2008 when BF personnel directed LB&B (a 
NARA contractor providing facilities and building services) to work with BX and "take the lead 
on this and get your technical experts to come up with some various scenarios." Although not 
documented, during an interview we learned that in 2009 the Contracting Officer's 
Representative (COR) for the LPR system project shifted responsibility for the project from 
LB&B to BF. This COR eventually left NARA and was replaced by a new COR in November 
of 2010. Furthermore, responsibility for the LPR system project was shifted between BX 
personnel in July of 2010. 

During our review we asked BX personnel why Heery was chosen as the vendor and what other 
entities used their LPR system. In addition, we asked the former COR for the LPR system 
whether any NARA personnel viewed LPR systems installed and functioning at other entities. 
The BX personnel interviewed did not know and could not provide documentation as to why 
Heery was chosen as the vendor and could not provide specific examples of other entities using 
LPR systems. Also, the former COR stated that Heery did provide an on-site demonstration at 
All, but no other demonstrations of LPR systems were viewed by NARA personnel. 

At the entrance interview for this audit, we requested any communications associated with 
obtaining the LPR system contract. NARA's Lead Security Specialist stated during a subsequent 
interview that they inadvertently deleted emails associated with obtaining the LPR system 
contract. This individual, who held the position of Lead Security Specialist at All, was highly 
involved with the research and selection of the LPR system. Because these emails were deleted, 
an evaluation of the rational used to make decisions regarding the selection of the LPR system 
was hindered. For example, a proposal for the LPR system was sent to NARA on February 27, 
2009. This proposal contained a scope of work that was very similar to the scope of work 
contained in the August 20, 2009 proposal accepted by NARA. However, the February proposal 
cost approximately $50,000 less than the August proposal. During this review NARA personnel 
could not provide documentation that explained why the proposal from February was not 
accepted, or why another proposal was sent in August. 
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Another individual from BX, who was assigned to the LPR system project in July of 2010, stated 
that when they were first placed on the project it was like "running with a project blind" because 
of the lack of background documentation. This individual also stated that when they started on 
the project regular meetings between NARA personnel and the contractors working on the LPR 
system were not taking place. In response to the lack of meetings, weekly progress meetings for 
the LPR system were initiated on July 14, 2010. 

The PIA completed for the LPR system asked if a risk assessment was performed. BX's 
response stated that a risk assessment was performed in August of 2009 that did not identify any 
risks associated with the LPR system. However, during our review, no risk assessment was 
produced. Further, during interviews with BX personnel, no one had knowledge of a risk 
assessment taking place. This situation provided another example of NARA personnel unable to 
provide documentation allowing us to identify and review decisions BX and BF personnel made 
related to the LPR system. 

Although our request for communications associated with obtaining the LPR system contract did 
not refer to a specific format, NARA personnel responded to this request by providing 
documentation in various formats including paper print-outs, Microsoft Word and Adobe 
portable document format (pdf) screenshots, and native Groupwise files. After reviewing 
NARA's communications utilizing these varying formats, it was noted that the native Groupwise 
files proved to be the easiest and clearest method of preserving and producing email 
communications. Emails produced as native Groupwise files also included attachments, which 
further streamlined our ability to effectively review the documentation provided. 



Recommendations 

3. We recommend the Security Management Division (BX) and Facility and Property 
Management (BF): 

a. Ensure compliance with GAO's "Standards for Internal Control in the Government" 
including ensuring that all transactions and other significant events are clearly 
documented and available for examination and all documentation and records are 
properly managed and maintained. 

Management Response 

Management concurred with the recommendation. 
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3. NARA's parking policies and procedures are not current. 

Our review of NARA's parking program revealed that NARA's parking policies and procedures 
were not current. This occurred because BX personnel made the decision not to update NARA's 
parking policies and procedures to reference use of the LPR system until the system had been 
accepted. As of the end of fieldwork the LPR system had not been accepted, and thus NARA's 
parking policies and procedures did not reflect the actual practices carried out by BX personnel 
and NARA's contracted security officers. 

NARA 232 Not Current 

NARA 232 represents the NARA policy directive detailing the procedures to control parking at 
AIL However, NARA 232 contains procedures no longer performed by BX personnel. This is 
affirmed by BX personnel referencing 232 as an "old directive" that is "outdated." Also, NARA 
232 did not include any references to the LPR system. 

Subpar. 232.4a(2) of NARA 232 states that NARA's Space and Security Management Division 
(now the Security Management Division or BX) "issues and retrieves all permanent parking 
permits." NARA 232 also addresses the issuance of parking permits in paragraphs 232.7 and 
232.8. However, BX personnel stated that BX no longer officially issues parking permits. 
Nevertheless, occasionally old parking permits are distributed to employees if they request one in 
order to alleviate the frustration NARA employees experience who have vehicles with license 
plates that cannot be read by the LPR system. 

Subpar. 232.1 1(b) of NARA 232 states that "without a parking permit an individual may not 
park in the loading dock or satellite lots (Pepco Lot)." However, this statement is inaccurate 
because the current procedures at All allow anyone to park at the Pepco Lot. Furthermore, 
security officers are directed to allow NARA employees and contractors to park at the Loading 
Dock if they present their NARA identification. 

Par. 232.13 of NARA 232 states that "NARA Federal Identity Card holders who have been 
issued an Archives II parking permit must display the permit at all times the vehicle is on 
NARA-controlled property." Again, this statement is inaccurate because the current procedures 
at All do not require the display of parking permits. 

Parking at All is controlled not only "with permits that authorize parking", as described in 
subpar. 232.6a, but also by the LPR system. However, as noted above NARA 232 did not 
include any references to the LPR system, despite its daily use (when functional) at All's Main 
Gate and Loading Dock. 

Post Orders Not Current 

In addition to NARA 232, Post Orders also provide another means for NARA to control parking 
at AIL Post Orders provide general procedures for security officers to follow while posted at 
specified locations throughout AIL 
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Our r eview of P ost O rders w as limite d to tho se t hat r eferenced duties pe rtaining t o NARA's 
parking pr ogram. Four of t he P ost O rders at All i nclude r eferences t o parking pol icies and 
procedures, these posts are 6, 12, 14, and 18. All of these Post Orders contained a reference to 
parking permits which are no longer officially distributed or maintained. In addition: 

> Post 6 - Staff Entrance Parking Garage 

• Stated that security officers record information when NARA employees sought to 
park without a parking permit although the practice no longer occurs. Also, it did 
not discuss the LPR system. 

> Post 12 - Exterior Roving Patrol 

• Stated that security officers conduct a parking permit check that no longer takes 
place. Further, it referenced reserved parking spaces that no longer exist. 

> Post 14 - Adelphi Road Main Gate 

• Stated that security officers record information when NARA employees sought to 
park without a parking permit although the practice no longer occurs. 

> Post 16 - Metzerott Road Entrance Gate 

• Stated that security officers record information when NARA employees sought to 
park without a parking permit although the practice no longer occurs. Also, it did 
not discuss the LPR system. 

BX personnel have stated that updates to NARA 232 and Post Orders associated with parking at 
All are in progress. However, they have also stated that these updates will not go into effect 
until the LPR system is accepted. In fact, a document produced by BX during the review stated 
that BX has indicated that they have "no desire to implement interim/temporary procedure [sic] 
for a partially functioning system." However, given the fact that the LPR system has been 
functioning only partially since implementation, BX should consider implementing procedures 
that accurately reflect NARA's efforts to control parking at AIL 

Recommendations 

4. We recommend the Security Management Division (BX): 

a. Ensure that Policy Directive 232, Parking at the National Archives at College Park 
(Archives II) is current. 

b. Ensure that Post Orders are current and include actual practices in use by security 
officers as directed by BX personnel. 

Management Response 

Management concurred with the recommendation. 
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Appendix A - Acronyms and Abbreviations 



232 


NARA Directive 232, Parking at the National Archives College Park Archives II 


801 


NARA Directive 801, Capital Planning and Investment Control (CPIC) 


All 


The National Archives Building at College Park, Maryland 


BX 


Security Management Division 


BF 


Facilities and Property Management Division 


CFR 


Code of Federal Regulations 


COR 


Contracting Officer's Representative 


CPIC 


Capital Planning and Investment Control 


GAO 


Government Accountability Office 


IDIQ 


Indefinite Delivery Indefinite Quantity 


ISP 


IT Policy and Planning Branch 


IT 


Information Technology 


LPR 


License Plate Recognition 


NARA 


National Archives and Records Administration 


NGC 


General Counsel 


OIG 


Office of the Inspector General 


PDF 


Portable Document Format 


PIA 


Privacy Impact Assessment 


PII 


Personally Identifiable Information 


RFID 


Radio Frequency Identification 
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Appendix B - Management's Response to the Report 




NATIONAL 
ARCHIVES 



Date: MAY 2 9 2012 

To: Paul Brachfeld, Inspector General 

From: David S. Ferriero, Archivist of the United States 

Subject: OIG Revised Draft Audit 12-12, Audit of NARA's Parking Program 



Thank you for the opportunity to provide comments on the revised draft of the Parking audit. We 
appreciate trie auditor s willingness to work with us to resolve questions and comments. 

We concur with the four recommendations in this audit, and will begin work on an action plan when 
the final report is issued. 

If you have any questions or need additional information on these comments, please contact Mary 
Drak by phone at 301-837-1668 or via email at mary.drak@nara.gov . 

David S, Ferriero 

Archivist of the United States 



NATION AL ARCHIVES *rtd 
RECORDS ADMINISTRATION 

tfuOl AO! trill ROAI"> 
COLLEGE PARK- VI D 20740-6001 
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Archivist of the United States (N) 
Deputy Archivist 
Chief Operating Officer 
NGC 
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Appendix D - CURE Notice 




if 



National Archives and Records Administration 



8601 AdelpMRoad 
College Park, Maryland 20740-6001 



p** ; November 19, 2010 

Reply to 

Aim of : Efr T J Contracting Officer 

s^t : CONTRACT #NAMA-04-SEM»0008 Delivery Order #0115 » CURE NOTICE 

to : HEERY International Inc. 

1099 14 th Street, NW, Suite 101 
Washington, DC 20005 



Dear! 



After las t w eeks meeting between NASS, NAF, HEERY, Mona and CTSi, I had a discussion with BsUtff. 
HH Band ^^^^Hin regards to HEERY's contract #NAMA-04-SEM-000S Delivery order #01. 1 5 
Archives II License Plate Recognition (LPR) Gate System. Basically the original contract was awarded 
on August 31, 2009 for the sum of $460,528,00 and since then we have issued two modifications to have 
this project completed. Since last year, the contractor has had multiple software and hardware issues on 
getting this project completed inspected and accepted. They have missed numerous deadline installation 
implementation dates. Modification/Amendment #1&2 were issued on August 31, 2010. Mod #1 was for 
the sum of $28, 679.73, and Mod #2 was for the sum of $4, 623,96 bringing this project to a total of 
$493,831.69. 

Over the past several months the contractor has to redevelop several software patches for the system to 
recognize different license plates. After several weekly progress meetings, it has been noted that the 
original software proposed cannot identify a variety of license tags. It has been noted that the original 
software form Gateway was developed in Europe and was designed to only identify tags that use straight 
number and letters (ex.„1234ABCD), The problems are that in the Metropolitan area there are multiple 
license tags with symbols, stack letters, and fonts. Although CTS1 sub-contractor has been trying to 
develop patches for certain letters, tag formats and different states this should have been discussed at the 
beginning of the contract not a year into it. Since last June of 2010, CTSI and Gateworks have been 
loading numerous software patches into the LPR servers located in NAS SCIF. This has also entailed 
having to have an NAS Security Representative having to spend hours for escorting contractors. 

After a year of data base and software changes, failed readings, system malfimctionsanoUhe 
inconvenience to NARA staff, researchers, visitors, contractors and volunteers fcg*£*5^Band 

myself have come to the conclusion that it is time to issued a cure letter to HEERY International Inc. 
They need informing that NARA wants a closing deadline date to this contract and a 100% reading rate, 
for all variety of license plates especially the different states within the commuting area- The PEPCO lot 
will be 100% automatically controlled by this system and we cannot afford anything other then 100% 
reading rate. We also believe that HEERY has had enough time to reconcile any changes that may be 



NARA 's web site is http://www.nara.gov 
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needed to have this system up and running properly. I believe after 15 months for a project that should 
have been accomplished in no more than four months, is enough time. 

In addition, if the contractor cannot get the software and system as a whole to work properly, maybe an 
option is to replace the LPR system with an new parking permit FIR system. My understanding was that 
the LPR system was supposed to be designed to replace a guard at the PEPCO lot and to provide NARA 
a cost saving on man power. Jfwe cannot get the system to give us a 1 00% then we are defeating what 
we set out to do. 



You are notified that the Government considers your performance in the above order a condition that 
is endangering performance of the Order, Therefore, unless this condition is cured within 30 days 
after receipt of this notice, the Government may terminate Heery for default under the terms and 
conditions of this contract order and effect the further use of Heery on subsequent Orders from 
NARA. 

I suggest Heery meet with their subcontractors and submit a final completion schedule providing a 
finished operating system as required and that will be adhered to. 



/$/ signed 





Contracting Officer 









CC: Official 

NAS 

NASS 
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Appendix E - Heery's CURE Notice Response 



hteKX Desert 

Decembers, 2010 Program Management 

FaciSitiea Masiagenjeni 



Contracting Officer 

National Archives a nd Records Ad ministration 
8601 Adeiphi Roac,^^^^^H 

College Park, MD 20740-8001 

RE: Archives fl ~~ License Plate Recognition (LPR) Gate System 
Delivery Order 011 5 - Cure Notice 
Contract No. NAMA-04-SEM-0008 



Dear | |: 

This letter acknowledges receipt of NARA's CURE Notice dated November 19, 2010, regarding 
the Archives If License Plate Recognition (LPR) Gate System. 

Heery acknowledges that the Gate works software system chosen by NARA has required a 
number of software patches. The Gateworks software identifies license plates with a straight 
number and letter system. The Gateworks software, iike any other LPR system, requires fine 
tuning to customize the system to read local ly-varying plates. The system reads a minimum five 
letters or numbers prior to granting access. The combination of irregular characters and 
symbols are aN variables, which the system must read. After much work and as demonstrated 
at our test of the PEPCO Lot Gate on December 1 t the system now reads the various types of 
plates from Virginia, DC, Maryland, Pennsylvania, New Jersey, and West Virginia successfully. 

Heery agrees that the installation and testing of the LPR system has taken longer than anyone 
on the project team envisioned or is happy with. We do note that the installation and testing of 
the system was complicated and delayed by a number of factors, including; 

* Relocation of the head-end equipment from a non-secure to a secure area as directed 
by NARA via change order, requiring NARA escorts and a more time-consuming 
installation. The placement of the head end m the SCfF room, in lieu of Room 2300, 
severely impacted the ^iari up and commissioning of the system. Typically, our 
subcontractors would have unlimited access to the system for programming, updating 
and upgrades. The secure location limited physical access to the system and required 
an escort from security for each time a programming/adjustment was needed. 



Heery International, fnc, 

A of professional servi* pratfi;^ 

1099 14lh Streei, NW, Suite 101, Wtehlnglon, DC 
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urtuv 



Decembers, 2010 
Page 2 



♦ The tack of remote access (aver the internet) to the software to aflow the installation of 
patches. 

♦ Removal by NARA T s separate contractors of existing equipment that was shown to 
remain at each of the gates. Heery understood that the gate/bollard control at the 
PEPCO lot were operational with the RFIO system. Once the RFtD system was 
removed by NARA, there was existing equipment requiring replacement. The bollards 
and gates required redesign and wiring changes to ailow system interaction with the 
LPR system. This additional work was funded by modifications issued by NARA on 
August 19, 2010 and August 31, 2010. 

♦ Failures in the existing fiber network installed by others that the LPR system ties into. 
The existing fiber issue is still being worked on by NARA for the Adelphi and Metzerott 
gates. 

♦ improper installation by others of ground loops at the PEPCO Lot. The system was 
malfunctioning as the location of the loops did not aiiow completion of the transaction 
and system reset. This work was funded by the modification issued by NARA on 
October 4, 2010. 



We have worked as a team with NARA to overcome each of these challenges. 

H is noteworthy that no required "read rate" for the LPR was included in the scope of work 
^ ; v developed by NARA (included herein as an Exhibit) which served as the basis for Mona 
P , , , • ; Eiectric's proposal to NARA. It is also noteworthy that Mona Electrics -proposal to NARA also 
did not specify a "read rate". Heery f s research indicates that there is no accepted industry 
standard (e.g. NIST f CSf, etc.) "read rate" for an LPR system. However, we were able to locate 
an article entitled "ANPR System Performance" (also included as an Exhibit) which, besides 
calling for the industry to establish such a standard, states that "The experience of system 
operators is that overall read rates for license plates are 90% to 94% in ideal conditions with 
excellent modem systems". Given the limitations of all LPR systems; NARA's demand for a 
100% read rate as stated in the CURE Notice is not achievable by any LPR system. Heery and 
our subcontractors have committed to providing a 95% read rate, which seems to exceed the 
standard suggested in the article. 

The most recent test performed on December 1, 2010, at the PEPCO Lot resulted in 110 
accepted transactions, 6 problems and 36 not entered in the database. These results show the 
LPR system working at 95.9% read accuracy for the PEPCO Lot At our December 1 f 2010 
progress meeting, we reviewed with the NARA representatives present that the operational 
soiution for all non-accepted plates is to direct those vehicles to the Metzerott Gate. 
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HEERY 



December 6,2010 
Page 3 



One particular concern with the operation of the LPR system is the need to NARA to correctly 
populate and then maintain the license piate database. 36 of the 152 vehicles (23 J%) that 
attempted to enter the PEPCO Lot were shown as "not in database", despite the protestations of 
the individual vehicle drivers thai they had submitted the required documentation to NARA for 
entry into the database. The LPR system wilf not work as intended unless the database is 
properly maintained. We also recommend a template be developed for staff to properly enter 
the plate numbers with various configurations; i.e.* stacked letters and symbols to improve the 
data entry, resulting in improved read accuracy. The database must be kept up-to-date by 
NARA to facilitate the final testing of the system, 

Heery met with the representatives of NARA, Mona, and their subcontractors at our Progress 
Meeting on December 1 t 2010 (minutes Q^achQd as part of the Exhibit) to reach a consensus 
on completing the project and the independent operating gate at the PEPCO Lot. The summary 
of the discussions follows; 

.1. The latest tests completed on December 1, 2010 at the PEPCO Lot indicate a much 
improved read rate of 95.9%, In order to increase read rate, an alternate ptate for the 
employees with symbols or stacked letter plates that cannot be read may be acceptable 

., to NARA. , / r ..... . : „ , 

2. in order to get the PEPCO Lot operating on the LPR System, NARA representatives 
indicated that under an access denied, that the individual couid be instructed to use the 
phone at the PEPCO guardhouse and be directed to the Metzerott gate. 

3. it was agreed a plan for formal testing will be submitted, testing performed and 
witnessed by NARA security and the project completed, as soon as possible. 

4. NARA required a list of other locations and operations from Heery with LPR Systems. 
This information has been requested from our subcontractor, Mona. 
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HEERY 



December 6, 2010 
Page 4 



We are working with our subcontractor {Mona} and have encbsed Attachment A as the Final 
Completion Schedule for the project, per your letter. We win continue to work with your team to 
successfully complete this project and maintain our 12 year relationship In providing services to 
NARA. 



Sincerely, 




Enclosures: Attachment A - Proposed Schedule 

Attachment B - Mona Electric letter dated December 6, 2010 
P l Exhibits - „ Progress Meeting Minutes dated December 1,2010 
_ Article on ANPR System Performance : 

^ ^ Progress Meeting Minutes dated April 21, 2'010 

NARA License Plate Reader Development Scope of Work 

Copy: | BnARA 
Hl!lL!JiL» NARA 
'ik w. >a777 ~J , Heery ■ 

F:\2004\04130-S2 All License Plate ID Gate Syste1\r„n12G61 0_At!_LPR Gate System J^ARAJ^URej-tr. doc 
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